Umbra Wiki attack-pattern attack-pattern/CAPEC-31
Back to wiki

CAPEC-31 — Accessing/Intercepting/Modifying HTTP Cookies

provenance: imported · ATT&CK: T1539 · CWE: CWE-20 CWE-113 CWE-302 CWE-311 CWE-315 CWE-384 CWE-472 CWE-539 CWE-565 CWE-602 CWE-642

CAPEC-31: Accessing/Intercepting/Modifying HTTP Cookies

MITRE CAPEC attack pattern

Status Draft
Typical severity High
Likelihood of attack High
Catalogue CAPEC 3.9 (2023-01-24)

Description

This attack relies on the use of HTTP Cookies to store credentials, state information and other critical data on client systems. There are several different forms of this attack. The first form of this attack involves accessing HTTP Cookies to mine for potentially sensitive data contained therein. The second form involves intercepting this data as it is transmitted from client to server. This intercepted information is then used by the adversary to impersonate the remote user/session. The third form is when the cookie's content is modified by the adversary before it is sent back to the server. Here the adversary seeks to convince the target server to operate on this falsified information.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-20, CWE-113, CWE-302, CWE-311, CWE-315, CWE-384, CWE-472, CWE-539, CWE-565, CWE-602, CWE-642

ATT&CK techniques: T1539

Prerequisites

  • Target server software must be a HTTP daemon that relies on cookies.
  • The cookies must contain sensitive information.
  • The adversary must be able to make HTTP requests to the server, and the cookie must be contained in the reply.

Skills required

  • Low: To overwrite session cookie data, and submit targeted attacks via HTTP
  • High: Exploiting a remote buffer overflow generated by attack

Consequences

  • Confidentiality: Read Data
  • Integrity: Modify Data
  • Confidentiality, Access Control, Authorization: Gain Privileges

Mitigations

  • Design: Use input validation for cookies
  • Design: Generate and validate MAC for cookies
  • Implementation: Use SSL/TLS to protect cookie in transit
  • Implementation: Ensure the web server implements all relevant security patches, many exploitable buffer overflows are fixed in patches issued for the software.

Source